Cash discounts are price reductions offered to customers who pay within a specified early payment period. For example, terms such as “2/10, net 30” encourage payment within 10 days by offering a 2 percent discount. This improves cash flow, reduces collection risk, and shortens the accounts receivable cycle. Quantity discounts encourage customers to buy larger volumes. Functional discounts compensate channel members for performing functions such as storage, selling, or distribution. Seasonal discounts encourage purchases during off-peak periods. Internal auditors reviewing revenue and receivable controls should evaluate whether discounts are authorized, accurately applied, properly recorded, and aligned with credit policy. Since the purpose is to encourage prompt payment, Option A is correct.

When inventory is understated (not included in the physical count) at year-end, the financial impact affects both cost of sales (COGS) and net income as follows:

Correct Answer (C - Cost of Sales is Understated and Net Income is Overstated)

The ending inventory is part of the formula used to calculate the cost of goods sold (COGS): COGS=BeginningInventory+Purchases−EndingInventoryCOGS = Beginning Inventory + Purchases - Ending InventoryCOGS=BeginningInventory+Purchases−EndingInventory

If ending inventory is understated, then:

COGS will be understated (because inventory that should have been counted as sold was omitted).

Net income will be overstated because COGS is lower than it should be, making profits appear higher.

This error causes financial misstatements, violating IIA auditing standards for financial accuracy.

Why Other Options Are Incorrect:

Option A (Cost of sales and net income are understated):

Net income would not be understated—it would be overstated because the cost of goods sold is too low.

Option B (Cost of sales and net income are overstated):

COGS would be understated, not overstated. If COGS were overstated, net income would be understated.

Option D (Cost of sales is overstated and net income is understated):

The opposite happens—COGS is understated and net income is overstated.

IIA GTAG 8: Audit of Inventory Management – Covers financial impact of inventory misstatements.

IIA Practice Guide: Auditing Financial Statements – Addresses common inventory errors and financial reporting impacts.

Step-by-Step Explanation:IIA References for Validation:Thus, C is the correct answer because an understated inventory reduces COGS and inflates net income.

When a limiting factor exists, production should prioritize the product with the highest contribution per unit of scarce resource. Material is limited to 500 kg. Product X has contribution of $10 − $2 material cost = $8 per unit, or $4 per kg. Product Y has contribution of $13 − $6 material cost = $7 per unit, or about $1.17 per kg. Product X gives higher contribution per kg, so the organization should satisfy full demand for X first. Producing 100 units of X uses 200 kg, leaving 300 kg. Product Y requires 6 kg per unit, so 300 kg allows production of 50 units. Internal audit should verify that scarce-resource decisions use contribution per limiting factor, not contribution per unit alone. Therefore, Option A is correct.

The internal audit plan should be risk-based. To achieve this, the CAE should develop an audit universe that lists all auditable units (processes, functions, systems, etc.) and use it as the foundation for risk assessment and prioritization.

Option B is too narrow (monetary value is just one factor). Option C is incomplete since senior management’s input is important but not the sole basis. Option D is incorrect because eliminating units not mandated by law ignores risk-based planning requirements.

Thus, the most appropriate approach is Option A: establishing an audit universe.

Before an external assessment of the internal audit activity, the CAE should agree with the board on the qualifications and independence of the external assessor or assessment team. This ensures credibility and compliance with the IIA’s Quality Assurance and Improvement Program (QAIP) requirements.

Options A and B (specific audit areas or testing levels) are not matters for board approval in external assessments. Option D (specialized skills) is relevant but not as essential as overall qualifications and competence.

Overseas production usually has the highest market-entry cost because it may require investment in foreign facilities, equipment, employees, supply chains, local compliance, management infrastructure, tax planning, and operational controls. It also exposes the organization to political, currency, labor, environmental, and regulatory risks. Exporting is generally less costly because products are produced domestically and sold abroad. Licensing usually requires lower investment because the licensee performs production or distribution in exchange for fees or royalties. Joint ventures may involve shared costs and risks with a local partner, making them less costly than wholly owned overseas production in many cases. Internal audit should evaluate whether management’s expansion method is consistent with risk appetite, available resources, and control capability. Therefore, Option D is correct.

The main objective of risk-based assurance is to demonstrate that audit observations are directly connected to organizational risks. By measuring the percentage of audit observations that can be tied to significant risks, the internal audit function shows that it is focusing on areas of importance to governance and risk management.

Options A, C, and D are useful performance metrics, but they do not measure the ability of internal audit to deliver risk-based assurance as directly as Option B.

A privacy and data protection program normally begins by understanding the organization’s data, defining scope, identifying privacy risks, and selecting an appropriate framework or control model. After the program structure and risks are defined, the organization can establish assessment and communication formats to monitor performance, report issues, and communicate results to stakeholders. Option B therefore comes last among the choices. Selecting the framework, defining implementation scope, and identifying risks are foundational activities that must occur before assessment and reporting can be meaningful. Internal auditors reviewing privacy programs should evaluate whether the organization understands personal data flows, legal obligations, consent, access, retention, third-party sharing, breach response, monitoring, and communication. Therefore, Option B is correct.

The issue described suggests a systemic authorization flaw, where users gain unrestricted access once logged in. This points to an improperly configured authorization system, which should enforce role-based or least-privilege access to restrict users based on their job responsibilities.

(A) Incorrect – The authentication process relies on a simple password only, which is a weak method of authorization.

While weak authentication is a security risk, the issue described relates to excessive access permissions, not weak login credentials.

(B) Correct – The system authorization of the user does not correctly reflect the access rights intended.

The problem is that users have access to all functionality, which indicates an authorization issue, not an authentication flaw.

Proper role-based access controls (RBAC) should limit user permissions based on job functions.

(C) Incorrect – There was no periodic review to validate access rights.

While periodic reviews are important for detecting unauthorized access, the issue here is a system-level authorization design flaw rather than a failure in periodic reviews.

(D) Incorrect – The application owner apparently did not approve the access request during the provisioning process.

Even if an access request was approved incorrectly, the broader issue remains that all users have unrestricted access, which suggests a system misconfiguration rather than a single provisioning error.

IIA’s GTAG (Global Technology Audit Guide) – Access Control and Authorization

Emphasizes the need for role-based access control (RBAC) to prevent unauthorized access.

COBIT Framework – IT Security Governance

Discusses proper authorization mechanisms to align system access with business needs.

NIST Cybersecurity Framework – Access Management Controls

Recommends restricting access rights based on the principle of least privilege (PoLP).

Analysis of Answer Choices:IIA References and Internal Auditing Standards:

A multi-domestic strategy is effective when large differences exist between countries in customer preferences, culture, regulation, distribution, pricing, language, or competitive conditions. Under this strategy, local subsidiaries or country managers are given flexibility to adapt products, marketing, operations, and customer approaches to local needs. Option A describes a global standardization strategy, not multi-domestic strategy. Option B is incorrect because multi-domestic strategy requires decentralized decision-making rather than centralized control. Option D describes advantages more commonly associated with global or transnational coordination, not local adaptation. Internal auditors reviewing multinational operations should understand the strategy because it affects authority, control consistency, compliance risk, reporting structures, and performance measurement. Therefore, Option C is correct.

Market skimming involves setting a high initial price to capture maximum revenue from customers willing to pay more, often before gradually lowering prices. It works best when buyers are relatively price-insensitive, when the product has strong differentiation, when high price supports a quality image, or when competitors cannot quickly enter or expand capacity. Option A is not true because falling unit costs with increased production generally supports market penetration pricing, where lower prices help build volume and market share. Skimming usually depends less on high volume and more on early high-margin sales. Options B, C, and D are consistent with a skimming strategy. Internal auditors reviewing pricing strategy should verify that management’s pricing assumptions match market conditions and capacity constraints. Therefore, Option A is correct.

In a hierarchical audit structure, work is reviewed across multiple levels of management, resulting in higher costs because highly skilled and experienced auditors are required for supervisory roles. This increases the cost base compared to a flat structure.

Option A exaggerates benefits of a flat structure. Option B is incorrect because hierarchical structures require more—not less—supervision. Option C is misleading because flat structures typically limit growth opportunities due to fewer layers of promotion.